Reliability & correctness
- Message metadata is preserved on move / archive / trash. Bulk-relocating a message no longer drops its delivery-recipient data, the sender "via" details, or plugin/GTD annotations — the reinsert now carries every column, and a test guards it against future drift.
- Emptying a folder no longer freezes the UI. Large folders are now emptied in the background: the action returns instantly with an "Emptying…" indicator and the view refreshes automatically when it completes. A concurrent empty of the same folder is rejected instead of starting a second delete.
- Forwarded-attachment sending is bounded. Forwarding many attachments no longer fans out unbounded database and IMAP work before the size check; the count and total size are validated up front and the bodies are fetched with bounded concurrency.
- Preference saves can't leak across sessions. A preference changed just before logging out or switching accounts is no longer flushed against the wrong session.
- Cleaner API errors. A malformed account or user id in a URL now returns a 400 instead of a 500.